Analysis

  • max time kernel
    429s
  • max time network
    1151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241023-en
  • resource tags

    arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-12-2024 19:54

General

  • Target

    Loader(dnd)/Loader.exe

  • Size

    13.1MB

  • MD5

    048ac9cef1a2a0770e626f0ec9634df3

  • SHA1

    d14330ff37a2827043bbc40c50bc19879103dbe1

  • SHA256

    7c407b3c332035c19d6c08780fcf04017d9ad9f05b6ed06047d5341eca9201fe

  • SHA512

    7139e333f49db124a84d485b667e4a6ab3ad44e56b5c5e92c9fb1f1aae45673ba8cfa45b1e7610dc9db643966b5ff11551c4866775877144c22b3735f4832ece

  • SSDEEP

    196608:FUqGuGYdgOh3Ej4y2JnnouxSEFxlRhWNXZXEXp9g0FQ1RCzuLpJG5QDp:BGuPdgOhkWnnoQSEdM1EXTgQQ1Qz80K

Score
10/10

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Gozi family
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader(dnd)\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader(dnd)\Loader.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4744-0-0x00007FF73FCB8000-0x00007FF7404E9000-memory.dmp

    Filesize

    8.2MB

  • memory/4744-2-0x00007FFDE8E60000-0x00007FFDE8E62000-memory.dmp

    Filesize

    8KB

  • memory/4744-1-0x00007FFDE8E50000-0x00007FFDE8E52000-memory.dmp

    Filesize

    8KB

  • memory/4744-3-0x00007FF73FC90000-0x00007FF741211000-memory.dmp

    Filesize

    21.5MB

  • memory/4744-6-0x00007FF73FC90000-0x00007FF741211000-memory.dmp

    Filesize

    21.5MB

  • memory/4744-7-0x00007FF73FCB8000-0x00007FF7404E9000-memory.dmp

    Filesize

    8.2MB

  • memory/4744-8-0x00007FF73FC90000-0x00007FF741211000-memory.dmp

    Filesize

    21.5MB